Posted
by
samzenpus
on Wednesday July 13, 2011 @06:13PM
from the malware-of-the-people dept.

jfruhlinger writes "VLC Media Player is a popular, useful, and free-as-in-beer piece of software. Unfortunately, its open source nature makes it easier for people with bad intentions to repackage it in nefarious ways. Not only do some of these folks claim that they're the originator of the software (a violation of trademark law and the license), but they often bundle it up with crapware and malware, which is a real dilemma for open source developers who play by the rules."

(Obviously the parent is just trying to push their pro-Debian agenda!)

Although it does bring up.. how much do/can you trust a repository? An md5 check will tell you that what you grabbed is what you wanted to grab, but whose to say that what your grabbing hasn't been manipulated in some way?

Most reputable repositories (Off the top of my head I know that the Fedora, Adobe, RPMFusion, and Dell repositories all use package signing keys) use GPG keys to sign and guarantee that a particular package is legit and has not been tampered with. Provided that you can trust the key issuer, if a given package passes its signature check then you know that has not been altered.

I wasn't intentionally trolling, just venting a little annoyance with the attitude that security problems with proprietary software shows how good Open Source is and security problems with OSS also show how good Open Source is. I have a chip on my shoulder about it, sue me.

I can understand your annoyance, I've often felt that one of the reasons linux suffers from so few malware incidents is that the users are generally more technically proficient and security conscious. I always notice where my software is coming from and take care to notice when I'm redirected by a site. I always check to make sure that I don't allow anything to be installed I didn't ask for. Not saying I'm a genius but I've noticed most windows users seem to download and just click okay buttons indiscriminately without reading anything.

it's all those wizards in the mid to late '90s. they created a culture of clicking through endless meaningless splashes and marketing spiels to get your software. if you ever read those things, you'd still be installing CorelDraw! 5 at this point.

we all got in the habit, the OS was not terribly secure, the internet grew faster than anyone expected, and now suddenly everyone's clicking through installers that fuck their machines.

add to that the fact that most AV programs are so woeful for performance that

Provide real world quantifiable evidence that OS is inherently more secure than closed source.

Don't need to, that's not the issue. Amusingly you zeroed right in on it...

And walking around with a chip on your shoulder is just a target for those wishing to knock it off.

Bingo! Nothing like an attractive target, mmm? Every boast about how great and secure OSS is, especially at a time where it isn't appropriate to be pumping the fist in the air, is a dare to somebody to prove it wrong. That whole 'chip on the shoulder' thing applies to OSS zealots, too.

As pointed out by osmanjuci, users of Unix-like OS's actually have a trusted, and trustworthy source from which to download VLC. As he so rightly pointed out, all I need do is type "aptitude install vlc" and it will be done in moments, downloaded from whichever Debian or Ubuntu repository I happen to have enabled for the computer I am on.

So, no *nix user is likely to download VLC from some disreputable site found on the internet.

But, wait. VLC is cross platform. I think it works on any platform that has

Yeah, I know it's silly to complain about 'news' headlines, but it sounded like the official distribution had been infected. That is not the case and http://www.videolan.org/vlc/ [videolan.org] is still a safe provider of the software.

I'm not surprised that VLC player is repackaged/distributed with malware, but the complaint about Google seems invalid as of today at least. I go search VLC media player [google.ca] on Google, and on the first and second page only get the legit software, no keyword ads or anything.

Yeah, I know it's silly to complain about 'news' headlines, but it sounded like the official distribution had been infected. That is not the case and http://www.videolan.org/vlc/ [videolan.org] is still a safe provider of the software.

Exactly. If you do a search for a printer's name, you often get a lot of random driver storage sites that pop up, but who's vetted that software? I always hit the manufacturer first, and for a piece of software I go to a known-good download site (like C-Net) as their business model is based partly on being a trusted source of software. If you aren't downloading VLC from the SourceForge repository, you're opening yourself up to using a hacked and backdoored product.

CNET is one of the safest places to download software from online. However, the author of the article, the suspiciously named Brian Proffitt, includes the following dubious paragraph on CNET:

"But then there's sites like CNET Download, which also lists FLOSS software (among many other types of applications) for download, directly from CNET's servers. While CNET does not in any way represent that they "own" the software they're offering, nor do I seriously believe they are offering up malware, I can't be

If you want the full blown Microsoft Office or Photoshop, you have to get them from shady website, because the original are paying.

How about actually paying for them if you want to use them? Or finding FOSS alternatives like OpenOffice? You don't have to get them from a "shady website", that's a choice. A morally dubious choice as well in my opinion.

It doesn't matter if it is open or close source. You are an idiot if you download anything from an untrusted source, point and end of discussion.

Interesting rebuttal. I assume you're responding to this statement, since it's the only statement in the summary where the response "no it doesn't" makes grammatical sense:

Unfortunately, its open source nature makes it easier for people with bad intentions to repackage it in nefarious ways.

So you're saying that no, it's not true that it's easier to repackage open-source software vs. proprietary, because people who "download anything from an untrusted source" are idiots. You realize that your response doesn't address the original statement, right? People downloading things are not related to how easy it is to repackage a

What i want to know is What difference does it make if something is closed or open to malware authors? I could package some malware up and put it on a website and call it MicrosoftSecurityEssentialsSetup.exe all day long and as soon as you click on it and click okay on the uac prompt, you're done. This has nothing to do with how easy it is to package vlc or anything else.

It really is easier to repackage software for which you have the source code, surprise surprise.

That may be true, but there's also never any reason to download FOSS from an untrusted source (except for not knowing any better). With cracked proprietary software, untrusted sources are the only sources.

That may be true, but there's also never any reason to download FOSS from an untrusted source (except for not knowing any better). With cracked proprietary software, untrusted sources are the only sources.

This is in stark contrast to some website with a strange name and ads all over the place where you can hardly find the link to what you're actually supposed to be downloading through all the 3rd party links to who knows where. Given what some windows download sites look like, it's little wonder that some people are starting to flee to the "walled garden".

I don't understand, what do I type into my IE to get to the project homepage? I don't think I have SourceForge or a repository installed. I'll just go to Google and type a vague description that makes sense to me.

Given what some windows download sites look like, it's little wonder that some people are starting to flee to the "walled garden".

Are you trying to imply that people who choose a "walled garden" approach are admitting that they are incompetent of handling something like their online security that is apparently supposed to be so rudimentarily simple?

Actually, this is nonsense. All you need to repackage software is the binaries. It's probably harder to turn a proprietary binary into adware but it is certainly no more difficult to repackage proprietary software so that it comes with some sort of extra malware payload.

Just recreate the installer. You don't even have to include the real binary.

Actually his reply was "so what if it's slightly easier to repackage open-source software; it's possible to repackage closed-source software too". Thus, "it doesn't matter if it is open or close source. You are an idiot if you download anything from an untrusted source".

What? No, that wasn't his reply. His reply was "No it doesn't" followed by a concise definition of what an idiot is.

Moral of the story: closed-source isn't more trustworthy than open-source.

That's right, the "trustworthiness" of each is about the same, but it's still easier to repackage software for which you have the code. In fact, the license for the OSS specifically allows it.

As a novice who wants to get VLC, why is www.videolan.org any more trusted than www.vlcmediaplayer.org?

If you google VLC media player, www.vlcmediaplayer.org is one of the top search results. Of course if you download from here and you have any virus or adware scanner close to being up to date, alarm bells will go off.

My father, who is pretty savvy, fell victim to this. He's pretty good with computers for someone 73 years old. I had recommended VLC to him, he googled it, and got crapware.

After fixing the problem, we both contacted the VLC developers, who were kind enough to reply. We suggested they seek legal recourse, but although they were aware of the problem, they were not inclined to pursue the matter. Total respect, their code, their choice.

I felt bad that I recommended VLC without specifying videolan.org. Now I do

>> You are an idiot if you download anything from an untrusted source
Like 80% of all internet users are "idiots" in this regard, those will have a hard time recognizing legit VLC, most of them even trust.com more then.org, so they can easily fall for this. Those blackhats perpetrators have the cash to pay for AdWords, that is why this is a HUGE problem. It is even more augmented by the fact that Google/AdWords has a helping hand in this.

The text in proprietary software can be patched to change attribution, and viruses can be attached to binaries easily enough. It's just a little easier with software for which the source code is available. Either way, don't "shop" in the wrong place.

Can't you just sign applications and installers with a self-signed certificate? Or is Windows smart enough to recognize this (untrusted publisher, yet signed) and warn the user (similar to how browsers deal with untrusted certs)? And assuming that the user *is* notified, how many people are just going to click through and acknowledge the warning and keep on installing/executing the app?

That being said, I do look at digital signatures whenever I'm unsure of the validity of the executable, but if it looks

Can't you just sign applications and installers with a self-signed certificate?

No, and it shows that you don't really understand what a self-signed certificate is. The whole certificate system is based on three entities, namely, the "certificate authority", the "sender" (software provider/signer) and "receiver". The idea is to certify that the "sender"'s authenticity. In laymans terms, the "certificate authority" tells the "receiver" that the "sender" is who he claims he is. The premise is that the "re

You can do this with any software. Scammers have been selling virus-loaded copies of Microsoft Office since the days of dial-up.

It's a badly written article, but this is potentially a harder problem to tackle for a popular OSS project than for a popular software vendor:

It's much easier for the scammers to get open source code to distribute, so popular OSS projects look like low-hanging fruit to scammers

If the scammers don't use the trademark in an illegal manner, the scammers can truthfully claim they have a license to distribute the program. For instance, they can dodge GPL violations by only aggregating their adware and spyware.

1. Agreed with everyone else, in that the summary is written in such a way that one would interpret VLC infected. Bad form on the summary writer's part. (insert rant about/. editing style, rabblerabble)

2. This is zero to do with FOSS. Even paid software can be used to shovel-out any form of virii, malware, digital Bubonic Plague, etc. This is about people downloading any and everything that has a link attached, from 'trusted' sources and flashing banner ads.

this is entirely and precisely why distros such as debian go to such lengths to place GPG digital signatures on the downloads; why they go to such lengths to enact extensive GPG key-signing web-of-trust exchanges etc. etc. no software is allowed into the archive that is not GPG digitally-signed by someone who is part of the GPG web-of-trust network (thus whose physical identity has been identified MULTIPLE times by their peers including showing proof of identity in the form of passports or other physical but trusted identification document).

the lengths to which for example the debian developers go are sufficiently extreme that it would be an incredibly foolish exercise for any debian developer to even attempt to place spyware or any kind of malware into packages, because they could be identified (via their GPG Digital Signature) and thus banned for life from the debian project.

the lengths to which it would be necessary to go, to circumvent such a system, involve cracking of GPG Digital Signatures or of compromising the Debian Packaging system itself, and switching off the signature-checking system. whilst the average person would not know how to check that this had occurred, it is an extremely remote and unlikely possibility in and of itself; the experienced debian user could boot up off of a live boot or rescue CD and use rkhunter or chkrootkit to verify that the system had not been compromised.

all in all it has to be said, in simpler terms (as many people on comments here have already said) - don't download stuff you can't trust! but if you can't be bothered to check, but are using a stupid operating system into which a package verification system is not built-in from the ground up, then don't use that stupid operating system! if you ignore this kind of advice, then you deserve everything that you get.

all in all it has to be said, in simpler terms (as many people on comments here have already said) - don't download stuff you can't trust! but if you can't be bothered to check, but are using a stupid operating system into which a package verification system is not built-in from the ground up, then don't use that stupid operating system!

They did make a package system where only vetted, approved software can be. And they called it an App Store. Last I checked slashdot didn't like the idea, so damned if you do and damned if you don't. People here still won't be pleased unless you run Linux.

An app store is fine, what is wrong with the Apple app store concept is that they work hard to prevent their customers from installing software from other sources. For example, C-Net has been mentioned as a trustworthy source of software downloads. Yet they cannot offer free software for iphones (unless the iphone is jailbroken, a precarious and risky procedure that is rarely done and shouldn't be necessary in the first place).

this is entirely and precisely why distros such as debian go to such lengths to place GPG digital signatures on the downloads; why they go to such lengths to enact extensive GPG key-signing web-of-trust exchanges etc. etc.

And Microsoft has gone to considerable lengths to promote and strongly encourage [microsoft.com] the usage of code signing [microsoft.com] for installers of Windows software. In fact many if not most of the larger Open Source projects that have a large Windows community sign their code too.

The problem is that people are use to ignoring the security warnings from Microsoft, compared to most administrators (or root/sudo users) read and heed [thefreedictionary.com] security warnings in Linux and *BSD package management.

I read that the window skinning download sites are polluted with malware. The good thing about mandatory driver signing in 64-bit Vista and later is that it protects sites like DriverGuide.com etc. from suffering the same fate.

in the event that you're not asking a rhetorical question: there isn't a dilemma, and there is no obstacle to overcome.

developers release source code (along with an MD5 or SHA-1 checksum) off of an implicitly-trusted (i.e. non-hijacked) web site. that is the limit and scope of their responsibility - period.

distribution managers have a responsibility to then check that checksum, and to ensure that the downloaded source code is not compromised. they are also responsible for compiling that software into a pa

The article has a link to the developer's blog which outlines the various companies which are abusing VLC by distributing it with malware. I noticed two interesting things about the blog posting:

(1) The developer refers twice to 'our IP' (violate our IP, enforce our IP). That's fine, but I imagine some Linux fanatics will be pissed that the developers consider intellectual property as a real thing and not an abstract constructed to be ignored, as some people want to believe.(2) Someone asked in the comments

Besides the obvious point that you can package any type of bloat or malware with closed-source software (spend some time putting together an installation wizard for Windows, and you'll see you can get away with pretty much anything), there's also the fact that F/OSS operating systems almost always have a package manager, which encourages only downloading through trusted sources. So the F/OSS way of doing things is to be careful about trusting where your binaries come from.

sudo apt-get install vlc is not gonna get you anything but a legit version of VLC, unless you setup JOez BaDazzz REPO by following directions on the 5th page of Google's search results.

the hottest software manager on the planet! just one click to download! one click to install!

apt is used the world over by leading government and industry agencies, including the department of defense (military grade), homeland security, IBM, NASA, and the FBI. now, through this special offer, apt is available to you, at no cost!

the hottest software manager on the planet! just one click to download! one click to install!

apt is used the world over by leading government and industry agencies, including the department of defense (military grade), homeland security, IBM, NASA, and the FBI. now, through this special offer, apt is available to you, at no cost!

Might be worth the malware to finally get a nice package manager on Windows;)

This happened to Mixxx DJ Software (http://mixxx.org), there was a web site that was shipping a Windows installer which installed crapware and Mixxx. The best part about it is their crapware would come up in the ads when you searched for Mixxx on Sourceforge!

The site that was promoting this crapware installer used the Mixxx name (trademark), several screenshots featuring the Mixxx logo and included a footer that indicated the contents of the page were copyright of their company 2008...

So we tracked them down and sent them a cease-and-desist email for violating our trademark (misrepresenting themselves as authors and using screenshots which feature the Mixxx brand without our consent)... Simply put we told them they could NOT use our trademark at all, this mean no screens with our logo, no mention of the projects name -> this means to comply with trademark law they will have to alter artwork (covered under the GPLv2) and in doing so will be required rebuild the app and redistribute all of the code also. As far as we are aware they complied and now they are substantially less relavent from a branding perspective and no longer really much of a threat to our user community...

You may not be able to enforce copyright if they comply with the terms of the license the software is distributed under (in this case GPLv2), but you can sure as hell stick it to people who attempt to tarnish your brand with trademark law and certainly make it far less convenient for these scum-balls to do this and still be on the right side of the law.

I can upload it to a server in China or India where the trademark is not observed and simply name it a higher version to fool the users to download my Mixx software instead of yours. That wont change unfortunately.

With Linux this isnt such an issue, as everyone knows you just tell the package manager to install vlc and it gets it from a trusted server and even does a hash check to make sure the final copy of the file/s downloaded are correct. Seriously someone should create a windows application manager apt for windows or something. Seriously right now most people using windows who want to install FOSS software are finding it hard to separate malware from the real deal. Windows 8 will have an app store but how rece

You don't need to get the source for VLC or even use an Open Source project. Just learn how to make an installer for the appropriate platform. A.dmg file for OSX, a.deb for use with gDebi or equivalent depending on distro for Linux and a nullsoft installer for windows. You could package it with the most common media player for any of those plaforms and if it is the bundled one, just claim it has some new feature and lie about the version number to get users to install the software and ensure it isn't t

and this is soooo much worse than the malware authors who do this on closed source software... how? Decompilers are readily available. The only thing they don't give you is the comments and annotations. If you're good enough to write decent malware then decompiling a closed source binary and inserting your payload really isn't an issue and people will trust what you put back into the wild because it's closed and "safe".

seriously, this is just like those people who sell paint.net I single this out because its not under an OSI license. Its not about license its about people downloading things they know nothing about. people don't research everything they download. Its hard to do good research when there are things like astroturfing [wikipedia.org] so it actually looks like the walled garden model of protecting your users is starting to look valid. Linux distros count as a walled garden if we are to call the community the gardeners who a

I do not remember which version but I reconized it as Gimp 3.02 for Windows when Gimp 2.x was on my Fedora 12 installation. I downloaded it and installed it and it tried to install some malware toolbars. I clicked cancel and ran a virus scan. Prettry clever and very cheap to do I may add for the average Joe to simply recompile it and create a website. FREE MONEY. With money for each installation of gatorsoft/claria or god know whats you can make money fairly easily. This was before Gimp 3.02 was out for win

Given that FOSS software is readily available from official website, downloading from anywhere else is just plain stupid. An argument can be made for people behind firewall or somehow cannot access any mirror, but it is otherwise true. Many project publish checksum of their tar balls and binaries, against which you can verify the downloaded item.
On the other hand, if there is a piece of commercial software that you must get your hands on but cannot afford. And the only way for many is get it is via some u

On the other hand, if there is a piece of commercial software that you must get your hands on but cannot afford. And the only way for many is get it is via some untrusted source illegally. That has to carry to much higher risk of malware.

And specifically, what software might that be? I cannot think of one that a person must have that they cannot afford, and for which there is no free or very inexpensive alternative. Not a one.Can't afford MS Office? OpenOffice/LibreOffice. Photoshop? GIMP or Paint.net.

Someone released a package of Tux Paint [tuxpaint.org] for Windows labeled "Tux Paint Plus", suggesting that it was somehow better. Upon further investigation, we discovered the "Plus" was simply a browser toolbar it injected without asking.

OTOH, I'm now utilizing OpenCandy [tuxpaint.org] to help "monetize" the project (read: pay for my coffee addiction and business cards to hand random parents at the park). At least it's (1) optional, and (2) I control which apps it suggests to users when they invoke the Tux Paint installer. (And no, t

How scary would a combo Wireshark + root kit or botnet be? A lot of companies download Wireshark, stick it on old laptops, park them on various parts of their network, and remote desktop into it as a cheap troubleshooting solution. Get malware on those boxes and the bad guys now can see inside everything that crosses the network, inside all the firewalls. Yikes!!

It's also that thing that is running a third of all smart phones and projected to be running half of them in a couple of years. In case you missed it, 500,000 Linux powered cell phones ship out everyday and none of them forget the correct resolution. Linux is everywhere and enjoyed by hundreds of millions of people everyday. Sorry to be the one to tell you.

So nice of you to be a dick about a joke, especially after ragging on someone else about that same thing right in this same thread. You might want to do something about that anger issue of yours. And learn how to spell and capitalize.

No, official vlc for android yet but they are working on it (http://ivoire.dinauz.org/blog/index.php?post/2011/02/02/VLC-on-Android) but in the mean time if you are up for it, you can always compile it yourself (http://wiki.videolan.org/AndroidCompile). I can't say I have had much luck working on the phone.